Smart wallets and new upgrades

An ordinary wallet is the key to a safe: whoever holds it has everything, whoever loses it has nothing. A smart wallet is more like a butler: you can tell it "pay no more than a thousand a day", "sign this with my fingerprint" or "if I lose my key, let my sister in". Just be careful whom you hand the butler to.

What a smart wallet is#

An ordinary account (EOA) is controlled by a single private key. A smart wallet is an account controlled by code – and the code can set rules:

• several signatures (multisig) – say 2 of 3 keys,
• account recovery through trusted people or devices, without a seed phrase,
• limits – a daily cap on withdrawals,
• several actions in one transaction – an approval and a swap at once,
• fees paid for you – an app can pay the gas, or you pay it in USDC.

Multisig wallets have existed for years; since March 2023 the ERC-4337 standard has made such accounts a common standard, and wallets are gradually adding it.

Pectra: smart features for an ordinary account too#

The Pectra upgrade (7 May 2025) brought proposal EIP-7702: an ordinary account can "borrow" a smart contract's code without changing its address. Your old account can then batch transactions or let someone else pay the fees.

The Fusaka upgrade (3 December 2025) made checking passkeys (passkey) cheaper – so a wallet can be unlocked with a fingerprint or face on your phone, without a seed phrase.

New features, new scams#

Every new feature is also a new opportunity for scammers. In June 2025 the firm Wintermute found that over 97% of EIP-7702 delegations pointed at contracts that automatically sweep everything arriving in the account. These were mostly accounts whose key had already been stolen – but the principle is clear: whoever gets you to sign a delegation controls your whole account.

Bybit: a multisig is not enough#

On 21 February 2025 about 1.5 billion dollars in ETH vanished from the Bybit exchange – the largest crypto theft in history. The money sat in a multisig where several people had to sign each transaction. The attackers broke into the computer of a developer of the Safe{Wallet} web app used for signing and slipped their own code into it. The signers saw an ordinary transfer; in fact they signed away the whole vault. The FBI attributed the attack to the North Korean group Lazarus.

The lesson: more keys do not help when everyone signs blindly what the same (hacked) screen shows them. For large amounts, check the actual transaction data on the hardware wallet screen and with an independent tool.

Common myths#

• "A smart wallet is automatically safer." Only with good code and good rules.
• "A multisig cannot be stolen." Bybit showed it can – through what the signers see.
• "You cannot have your own wallet without a seed phrase." With a smart wallet and passkeys you can.